CVE-2020-14303

high-risk
Published 2020-07-06

A flaw was found in the AD DC NBT server in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4. A samba user could send an empty UDP packet to cause the samba server to crash.

Do I need to act?

!
26.4% chance of exploitation in next 30 days
EPSS score — higher than 74% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (10)

Affected Vendors

Debian Samba Canonical Fedoraproject Opensuse

References (22)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00030.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.html
https://bugzilla.redhat.com/show_bug.cgi?id=1851298%3B
Mailing List https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Third Party Advisory https://security.gentoo.org/glsa/202007-15
Third Party Advisory https://security.netapp.com/advisory/ntap-20200709-0003/
Third Party Advisory https://usn.ubuntu.com/4454-1/
Third Party Advisory https://usn.ubuntu.com/4454-2/
Vendor Advisory https://www.samba.org/samba/security/CVE-2020-14303.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00030.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.html
https://bugzilla.redhat.com/show_bug.cgi?id=1851298%3B
Mailing List https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Third Party Advisory https://security.gentoo.org/glsa/202007-15
Third Party Advisory https://security.netapp.com/advisory/ntap-20200709-0003/
Third Party Advisory https://usn.ubuntu.com/4454-1/
and 2 more references
57
/ 100
high-risk
Severity 26/34 · High
Exploitability 15/34 · Moderate
Exposure 16/34 · Moderate